Loading malware…
DarkWatchman is a Windows-based remote access trojan associated with the Hive0117 intrusion set and used in campaigns primarily targeting Russian organizations, including accountants, financial departments, and entities in aerospace and related sectors. First observed in 2021, it is notable for a registry-centric, low-footprint design that combines a JavaScript backdoor with a PowerShell keylogger and minimizes reliance on conventional dropped executables.
DarkWatchman commonly arrives through phishing or spearphishing lures, including password-protected archives and fake software download pages. Infection chains have used self-extracting archives that deploy an obfuscated JavaScript backdoor and an encrypted blob that decrypts into base64-encoded PowerShell implementing keylogging. The JavaScript component executes through Windows Script Host and has been observed compiling C# code on victim systems via csc.exe, reflecting compile-after-delivery tradecraft.
The malware establishes persistence through scheduled tasks and stores configuration data, staged payloads, and collected information in the Windows Registry. It queries the Registry to determine whether it is already installed and modifies Registry values to retain configuration strings, encoded keylogger content, and collected output. This registry-heavy approach reduces on-disk artifacts and supports defense evasion. DarkWatchman has also been observed deleting installation artifacts, clearing browser history, uninstalling malicious components from the Registry, and deleting volume shadow copies when privileges permit.
Its capabilities include remote command execution, including PowerShell execution, host profiling, and collection of victim metadata such as username and OS locale. It can enumerate antivirus products and gather peripheral-related information, including signed Plug and Play drivers for smart card readers. The PowerShell keylogger captures keystrokes and has also been reported collecting clipboard and smart-card-related information relevant to abuse of remote banking workflows. Collected data is staged in the Registry, encoded before transmission, and exfiltrated over an encrypted command-and-control channel using TLS.
Operationally, DarkWatchman has been linked both to espionage-style targeting and financially motivated intrusions. In campaigns against accountants and business users, operators used the malware to gain access to remote banking environments and facilitate theft. The malware’s combination of JavaScript execution, PowerShell-based collection, registry-backed storage, and scheduled-task persistence makes it a distinctive fileless-style RAT focused on stealthy post-compromise control and data theft on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We attribute the executable with a high level of confidence to the DarkWatchman malware family, a custom-made backdoor leveraged the intrusion set Hive0117.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
The backdoor creates a scheduled task to run with elevated permissions ... and is used to maintain persistence on the system, and is named using the UID.
Subsequently, it runs the JavaScript file with the following two commands in sequence via the command prompt... powershell.exe ... Add-MpPreference ... & ... wscript.exe /E:jscript 144039266 131
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
The JavaScript backdoor is executed using the Windows Script Host (WSH) environment, wscript.exe.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
The backdoor creates a scheduled task to run with elevated permissions ... and is used to maintain persistence on the system, and is named using the UID.
The JavaScript backdoor ... utilizes the Windows Registry as a storage mechanism for configuration and other data to avoid writing to disk and avoid detection by anti-virus software. In particular, the keylogger is stored in the Registry in an encoded form until executed.
The JS file contains obfuscated code that functions as the backdoor, and the blob contains encrypted data that when decrypted, contains a block of base64 encoded PowerShell that implements a keylogger.
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.
The email posed as an internal communication... sent by a typo squatted domain ‘cdek[.]rest ’spoofing the logistic provider CDEK... posing as Al Jaber Group
As part of the installation routine, the backdoor will delete the SFX file to remove evidence of the file’s existence... The keylogger file is removed upon installation.
the script extracts a 4-byte key from the first 8 characters of the input string and XORs the remaining characters of the string with the key to obtain the data. Finally, the decrypted Base64 encoded data is saved to the registry
the RAT proceeds to execute a system command to delete all the restore points... Next, the function registers the “dynwrapx.dll” library by copying it to the %temp% directory and running the “regsvr32.exe” command with the “/i” and “/s” flags to install the library silently.
The JavaScript backdoor ... utilizes the Windows Registry as a storage mechanism for configuration and other data to avoid writing to disk and avoid detection by anti-virus software. In particular, the keylogger is stored in the Registry in an encoded form until executed.
Finally, the script checks if the registry value “HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM\< uid + 0 >” exists... The malware saves all its configuration and the keylogger file content in the above-mentioned registry key.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
After that, the RAT collects the victim’s system information, such as operating system version, locale, computer name, username, domain role, and antivirus software.
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
The blob contains encrypted data that when decrypted, contains a block of base64 encoded PowerShell that implements a keylogger.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Тот, в свою очередь, перехватывает нажатия клавиш, следит за содержимым буфера обмена...
Next, the function attempts to connect to a C&C URL retrieved from the registry key uid + ‘c’... After gathering the captured stolen information, the RAT sends it to the C&C server.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
According to IBM’s X-Force, the malware collects system information and generates a beacon that will transmit the following information to the C2... An initial HTTP POST request is sent to the server's '/register' endpoint, transmitting the gathered system information.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fileless malware used to infect accountants’ machines, deploy a keylogger, capture keystrokes and clipboard contents, monitor cryptographic token connection, and facilitate theft from remote banking systems.
A remote access trojan used to maintain covert control over compromised systems, execute remote commands, download additional malicious tools, and move laterally across victim networks.
Known malware delivered via phishing; campaign targeted multiple sectors in Russia (and referenced alongside 'Sheriff').
Remote access trojan and stealer capable of data theft and providing hands-on keyboard control to attackers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.